How Alibaba’s Trusted Apps Enabled a Phishing Scam via Xianyu QR and Alipay

Attack Flow

Victim scanned a Xianyu product‑share QR code. The QR code resolved to a Taobao short link, which deep‑linked to Alipay. Inside Alipay’s built‑in browser a page that mimicked Xianyu was displayed and the victim paid ¥2300.

Bypassed Security Signals

All URLs belonged to official Alibaba domains ( taobao.com, alipay.com, qianwen.com) with valid HTTPS certificates, so the usual anti‑fraud cues (unknown link, missing HTTPS, external‑link warning) were absent.

Trust Borrowing Mechanism

The phishing page was hosted on the CDN domain workspace‑zb‑cdn.qianwen.com, which belongs to the “Tongyi Qianwen” large‑language‑model service. The TLS certificate lists “Alibaba (China) Network Technology Co., Ltd.”, placing the domain in Alipay’s internal whitelist. Alipay therefore treated the page as trusted and did not show any security prompt.

The CDN page loaded a shell with a Xianyu‑style header and embedded a full‑screen iframe pointing to the real phishing site sunaiqwq.top. Because the outer URL remained the Qianwen CDN domain, the address bar never revealed the malicious domain.

Chain of Trust

Sequence of hops:

Xianyu QR code → Taobao short link

Taobao short link → Alipay deep link

Alipay WebView loads workspace‑zb‑cdn.qianwen.com CDN page embeds sunaiqwq.top in an iframe

User completes payment inside Alipay

Each hop uses a domain that is whitelisted by the next product, so the “self‑service exemption” bypasses verification at every step.

Why the Long Redirection?

Alipay’s built‑in browser blocks direct navigation to unknown external domains by showing a warning and suggesting opening the link in an external browser. By routing through trusted Alibaba domains, the warning is never triggered.

The whitelist mechanism requires merchants to add their domains via the Alipay Open Platform ( https://opendocs.alipay.com/mini/component-ext). Because the CDN domain is already in the whitelist, no additional check occurs.

Technical Details of the Phishing Host

The malicious domain sunaiqwq.top is registered on Alibaba Cloud, with its MX record pointing to Tencent Cloud ( mxbiz1.qq.com). The phishing HTML was uploaded to the Qianwen CDN, making it publicly accessible without triggering content‑review filters.

Historical Context

2023 – reports of Alipay’s built‑in browser being used for scams (Landian News) [2].

2025 – Alibaba Cloud OSS domains used for phishing sites (V2EX) [3].

2026 – Innora AI disclosed Alipay DeepLink and WebView whitelist bypasses; vendor classified it as a normal feature.

Implications

The design assumes that internal domains are safe, turning the entire ecosystem into a high‑speed, unguarded highway for fraud. The vulnerability is not a single bug but a systemic risk arising from the “self‑service exemption” where “own‑service does not require inspection”.

References

[1] Alipay Open Platform domain whitelist: https://opendocs.alipay.com/mini/component-ext [2] “Alipay built‑in browser used for scams; avoid scanning QR codes in Xianyu transactions” – https://www.landian.news/archives/98586.html

[3] “Alibaba Cloud OSS domains used for phishing sites” – https://v2ex.com/t/1137419